Security update for git SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:1872-1 Final 1 1 2018-07-03T16:09:37Z current 2018-07-03T16:09:37Z 2018-07-03T16:09:37Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for git This update for git to version 2.16.4 fixes several issues. These security issues were fixed: - CVE-2018-11233: Path sanity-checks on NTFS allowed attackers to read arbitrary memory (bsc#1095218) - CVE-2018-11235: Arbitrary code execution when recursively cloning a malicious repository (bsc#1095219) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-Module-Basesystem-15-2018-1267,SUSE-SLE-Module-Development-Tools-15-2018-1267 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20181872-1/ Link for SUSE-SU-2018:1872-1 https://lists.suse.com/pipermail/sle-security-updates/2018-July/004237.html E-Mail link for SUSE-SU-2018:1872-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1095218 SUSE Bug 1095218 https://bugzilla.suse.com/1095219 SUSE Bug 1095219 https://www.suse.com/security/cve/CVE-2018-11233/ SUSE CVE CVE-2018-11233 page https://www.suse.com/security/cve/CVE-2018-11235/ SUSE CVE CVE-2018-11235 page SUSE Linux Enterprise Module for Basesystem 15 SUSE Linux Enterprise Module for Development Tools 15 git-core-2.16.4-3.3.2 git-2.16.4-3.3.2 git-arch-2.16.4-3.3.2 git-cvs-2.16.4-3.3.2 git-daemon-2.16.4-3.3.2 git-doc-2.16.4-3.3.2 git-email-2.16.4-3.3.2 git-gui-2.16.4-3.3.2 git-svn-2.16.4-3.3.2 git-web-2.16.4-3.3.2 gitk-2.16.4-3.3.2 git-core-2.16.4-3.3.2 as a component of SUSE Linux Enterprise Module for Basesystem 15 git-2.16.4-3.3.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 git-arch-2.16.4-3.3.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 git-cvs-2.16.4-3.3.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 git-daemon-2.16.4-3.3.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 git-doc-2.16.4-3.3.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 git-email-2.16.4-3.3.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 git-gui-2.16.4-3.3.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 git-svn-2.16.4-3.3.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 git-web-2.16.4-3.3.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 gitk-2.16.4-3.3.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, code to sanity-check pathnames on NTFS can result in reading out-of-bounds memory. CVE-2018-11233 SUSE Linux Enterprise Module for Basesystem 15:git-core-2.16.4-3.3.2 SUSE Linux Enterprise Module for Development Tools 15:git-2.16.4-3.3.2 SUSE Linux Enterprise Module for Development Tools 15:git-arch-2.16.4-3.3.2 SUSE Linux Enterprise Module for Development Tools 15:git-cvs-2.16.4-3.3.2 SUSE Linux Enterprise Module for Development Tools 15:git-daemon-2.16.4-3.3.2 SUSE Linux Enterprise Module for Development Tools 15:git-doc-2.16.4-3.3.2 SUSE Linux Enterprise Module for Development Tools 15:git-email-2.16.4-3.3.2 SUSE Linux Enterprise Module for Development Tools 15:git-gui-2.16.4-3.3.2 SUSE Linux Enterprise Module for Development Tools 15:git-svn-2.16.4-3.3.2 SUSE Linux Enterprise Module for Development Tools 15:git-web-2.16.4-3.3.2 SUSE Linux Enterprise Module for Development Tools 15:gitk-2.16.4-3.3.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20181872-1/ https://www.suse.com/security/cve/CVE-2018-11233.html CVE-2018-11233 https://bugzilla.suse.com/1095218 SUSE Bug 1095218 In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server. CVE-2018-11235 SUSE Linux Enterprise Module for Basesystem 15:git-core-2.16.4-3.3.2 SUSE Linux Enterprise Module for Development Tools 15:git-2.16.4-3.3.2 SUSE Linux Enterprise Module for Development Tools 15:git-arch-2.16.4-3.3.2 SUSE Linux Enterprise Module for Development Tools 15:git-cvs-2.16.4-3.3.2 SUSE Linux Enterprise Module for Development Tools 15:git-daemon-2.16.4-3.3.2 SUSE Linux Enterprise Module for Development Tools 15:git-doc-2.16.4-3.3.2 SUSE Linux Enterprise Module for Development Tools 15:git-email-2.16.4-3.3.2 SUSE Linux Enterprise Module for Development Tools 15:git-gui-2.16.4-3.3.2 SUSE Linux Enterprise Module for Development Tools 15:git-svn-2.16.4-3.3.2 SUSE Linux Enterprise Module for Development Tools 15:git-web-2.16.4-3.3.2 SUSE Linux Enterprise Module for Development Tools 15:gitk-2.16.4-3.3.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20181872-1/ https://www.suse.com/security/cve/CVE-2018-11235.html CVE-2018-11235 https://bugzilla.suse.com/1095219 SUSE Bug 1095219